rpms/openldap/F-9 openldap-2.3.27-ber-decode.patch, NONE, 1.1 openldap.spec, 1.123, 1.124

[Jan Šafránek (jsafrane)]

Author: jsafrane

Update of /cvs/pkgs/rpms/openldap/F-9
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv13188

Modified Files:
	openldap.spec 
Added Files:
	openldap-2.3.27-ber-decode.patch 
Log Message:
fix CVE-2008-2952
Resolves: #453727

openldap-2.3.27-ber-decode.patch:

--- NEW FILE openldap-2.3.27-ber-decode.patch ---
453637, 453638, 453639, 453640,453444: CVE-2008-2952 OpenLDAP denial-of-service 
flaw in ASN.1 decoder

Source: upstream, cvs diff -r 1.120 -r 1.122 libraries/liblber/io.c

Index: libraries/liblber/io.c
===================================================================
RCS file: /repo/OpenLDAP/pkg/ldap/libraries/liblber/io.c,v
retrieving revision 1.120
retrieving revision 1.122
diff -u -r1.120 -r1.122
--- libraries/liblber/io.c	7 Jan 2008 23:20:03 -0000	1.120
+++ libraries/liblber/io.c	1 Jul 2008 23:33:15 -0000	1.122
@@ -522,14 +522,18 @@
 	}
 
 	while (ber->ber_rwptr > (char *)&ber->ber_tag && ber->ber_rwptr <
-		(char *)&ber->ber_len + LENSIZE*2 -1) {
+		(char *)&ber->ber_len + LENSIZE*2) {
 		ber_slen_t sblen;
 		char buf[sizeof(ber->ber_len)-1];
 		ber_len_t tlen = 0;
 
+		/* The tag & len can be at most 9 bytes; we try to read up to 8 here */
 		sock_errset(0);
-		sblen=ber_int_sb_read( sb, ber->ber_rwptr,
-			((char *)&ber->ber_len + LENSIZE*2 - 1)-ber->ber_rwptr);
+		sblen=((char *)&ber->ber_len + LENSIZE*2 - 1)-ber->ber_rwptr;
+		/* Trying to read the last len byte of a 9 byte tag+len */
+		if (sblen<1)
+			sblen = 1;
+		sblen=ber_int_sb_read( sb, ber->ber_rwptr, sblen );
 		if (sblen<=0) return LBER_DEFAULT;
 		ber->ber_rwptr += sblen;
 
@@ -579,7 +583,7 @@
 			int i;
 			unsigned char *p = (unsigned char *)ber->ber_ptr;
 			int llen = *p++ & 0x7f;
-			if (llen > (int)sizeof(ber_len_t)) {
+			if (llen > LENSIZE) {
 				sock_errset(ERANGE);
 				return LBER_DEFAULT;
 			}


Index: openldap.spec
===================================================================
RCS file: /cvs/pkgs/rpms/openldap/F-9/openldap.spec,v
retrieving revision 1.123
retrieving revision 1.124
diff -u -r1.123 -r1.124
--- openldap.spec	6 Jun 2008 08:13:25 -0000	1.123
+++ openldap.spec	2 Jul 2008 10:08:26 -0000	1.124
@@ -33,6 +33,7 @@
 Patch9: openldap-2.3.37-smbk5pwd.patch
 Patch10: openldap-2.4.6-multilib.patch
 Patch11: openldap-2.4.9-evolution-crash.patch
+Patch12: openldap-2.3.27-ber-decode.patch
 
 # Patches for the evolution library
 Patch200: openldap-2.4.6-evolution-ntlm.patch
@@ -134,6 +135,7 @@
 %patch9 -p1 -b .smbk5pwd
 %patch10 -p1 -b .multilib
 %patch11 -p1 -b .evolution-crash
+%patch12 -p0 -b .ber-decode
 
 cp %{_datadir}/libtool/config.{sub,guess} build/
 popd
@@ -563,6 +565,9 @@
 %attr(0644,root,root)      %{evolution_connector_libdir}/*.a
 
 %changelog
+* Wed Jul  2 2008 Jan Safranek <jsafranek at redhat.com> 2.4.8-6
+- fix CVE-2008-2952 (#453727)
+
 * Fri Jun  6 2008 Jan Safranek <jsafranek at redhat.com> 2.4.8-5
 - fix a crash (#450017)